AI Daily — 2026-10-09

TL;DRGoogle Cloud launched a universal Gemini agent that works across Gmail, Drive, Docs and Calendar with its own mailbox and permissions; Zenity disclosed that a single prompt could hijack every agent in an AWS Bedrock AgentCore account, the same day ARTEX plus Claude Code breached South Korean banks and leaked 25,000+ records from Shinhan Bank; Manus's parent raised over $500M in its first funding round after Beijing blocked Meta's acquisition, while Nous Research and Rein Security raised $90M and $25M respectively; Claude Haiku 5.5's model card and new Claude Max/Team API credit pricing also shipped.

#ai-agent #daily

Series: AI 日報 (55 / 53)

AI Daily — 2026-10-08 AI Daily — 2026-10-10

🌏 繁體中文版

The One-Line Verdict

The moment enterprises let an agent send its own emails and touch wealth-management-grade systems on its own, the security perimeter hasn't caught up yet — and capital is already betting that "patching the hole" will be more profitable than "opening it."

Deep Dive: The Day Agent Approval Friction Hit Zero, Attackers Got the Same Discount

I think the thing most worth connecting today is that an agent's commercial value and its attack surface are two sides of the same design decision. (Framework: transaction costs)

Evidence A: Google Cloud launched a universal "Gemini agent" that works across Gmail, Drive, Docs and Calendar, able to spin up "coworker agents" with their own mailbox and permissions; finance and legal versions are already in preview. This essentially turns a chain of cross-system actions that used to require human sign-off into something the agent runs automatically in the background — transaction cost pushed toward zero.

Evidence B: the same day, Zenity Labs researchers found that a single publicly accessible AWS Bedrock AgentCore agent could, through an internal temporary-credential interface, take over every other agent in the same account and region. South Korea's case is even more direct: attackers combined the open-source pentesting tool ARTEX with Claude Code to breach multiple South Korean banks, leaking 25,000+ customer records from Shinhan Bank. Both incidents share the same structure — once an agent's "no-approval-needed" permissions get hijacked, attackers inherit the exact same no-approval discount, with no human gate in between.

What this means for practitioners: Rein Security raised a $25M Series A the same day, building exactly the runtime monitoring layer that restores the approval step that was removed — confirming that the labor savings from agent autonomy and the attack surface it opens are never something you can buy separately. For Taiwanese enterprises looking to replicate the kind of financial-agent case studies seen recently, the question before letting an agent touch a wealth manager's systems or customer data shouldn't be "how much labor can this save me," but "who stops it when its permissions get stolen."

Today's Developments

Vendor Updates

Google: Google Cloud launched a universal "Gemini agent" that works across Gmail, Drive, Docs and Calendar, able to spin up "coworker agents" with their own mailbox and permissions; finance and legal versions are already in preview, with government, healthcare and retail versions coming soon (see Deep Dive). (reuters)

Meta + Sierra: jointly announced the "Personal Agent Protocol," specifying how personal AI agents log into businesses, what permissions they get, and what businesses allow them to do; first partners include Genesys, Instinct, Rocket, Shopify, Stripe and Walmart, with v0.1 of the spec expected later this month. (ameztrix)

Anthropic: launched Claude Dashboards (connects to BigQuery, Databricks, Snowflake, Salesforce and other data sources to generate auto-updating live dashboards from text) and Motion (generates editable, MP4-exportable animated explainer videos from text), claiming these tools have already produced over 45 million documents. (the-decoder)

SAP: CEO Christian Klein demonstrated the "Autonomous Enterprise" scenario powered by the SAP Business AI Platform at SAP Connect, showing enterprise processes being carried out by agents in practice. (news.sap.com)

Models & Infrastructure

Claude Haiku 5.5: Anthropic's small model now supports effort adjustment for the first time, costs 75% less on average than Haiku 4.5, and jumped from 15.7% to 72.4% on OSWorld 2.1 — see this site's model card.

Scale AI's "Humanity's Sixth Sense": released jointly with Elorian, this new benchmark tests models' ability to infer implied spatial, social, temporal and abstract meaning in images and video; the best model, GPT-6-astra, scored just 53.6%, far below the human score of 93.1%. (superpowerdaily)

Microsoft Dynamic Workflows: a new Azure Functions Hosted Skills feature where the model writes a one-time execution plan (a DAG) and hands the rest off to Durable Functions; Microsoft's internal benchmarks show 56–93% less token usage and 77–95% lower end-to-end latency. (devblogs.microsoft.com)

Windows ML: added experimental llama.cpp support, letting developers run GGUF-format models locally on Windows through a new task-based API. (devblogs.microsoft.com)

Pricing & API Lifecycle

Claude Max/Team API credits: starting October 7, Anthropic gives Max/Team subscribers free monthly Claude API credits — $100 for Max 5x, $200 for Max 20x, up to $500 for Team depending on seats — replacing the Agent SDK credit program discontinued this past June. See this site's pricing tracker.

Tools & Ecosystem

Atlassian MCP Server: reached general availability, letting developers build custom MCP tools with Forge or extend MCP capabilities through Marketplace apps, and exposing custom Rovo agents to external AI tools via MCP. (atlassian.com)

Microsoft: Agent Experience (AX): a new post argues that an agent reporting success, with code that compiles, doesn't mean it actually chose or used your tech stack correctly, and discusses how to measure AX and why the most intuitive fix isn't necessarily right. (devblogs.microsoft.com)

Today's GitHub Digest focuses on what happens after a coding agent writes the code: trueforge (6,083★) packages agent-harness session, sandbox and approval handling into a reusable runtime; agent-device (4,937★) lets an agent open an app and tap through it on a phone simulator to verify its own code changes; pi-pocket packs an entire agent session into your phone. Claude Code v2.1.294 also patched a bug where natural-language-written hooks failed to block commands they were supposed to block. See AI Agent GitHub Digest.

postgres2mcp: a self-hosted open-source MCP server that wraps any Postgres connection into a governed tool interface, solving the all-or-nothing authorization problem when multiple agents share one database. See this site's tool recommendation.

Omnigent / Gentle-AI: on GitHub's coding-agents topic page, Omnigent — an open-source meta-harness that orchestrates Claude Code, Codex, Cursor and other agent harnesses (10K stars) — and Gentle-AI — a tool for configuring memory, skills and MCP servers across coding agents (7,600 stars) — both saw updates, signaling continued open-source competition at the agent-harness layer. (github.com/topics/coding-agents)

Technical Progress

Today's three Arxiv Digest papers converge on one message: an agent's real attack surface isn't how the model reasons — it's what it sees on screen, what rule files it reads, and the desktop it operates. WebMirage shows that controlling a single small image on a web page is enough to hijack visual grounding into an attacker-chosen browser action, with a 91.9% success rate; PackHallu shows that poisoning one community-shared coding-agent rule file can get tools like Claude Code and Cursor to swap legitimate packages for attacker-controlled malicious ones, with over 70% average attack success; Secure-CUA demonstrates a defense that locks both action generation and visual grounding into one formally "bounded endorsement," buying near-full defense at almost no cost to task success. Full analysis of all three papers in AI Agent Arxiv Digest.

Security Incidents & Defenses

ARTEX + Claude Code breaches South Korean banks: a CrowdStrike report says a suspected 26-year-old attacker from Guangdong, China used the open-source pentesting tool ARTEX (combining DeepSeek, GLM and Grok) together with Claude Code to breach multiple South Korean banks; Shinhan Bank leaked 25,000+ customer records, and South Korea's financial regulator has convened an emergency meeting (see Deep Dive). (reuters)

Single-prompt hijack of AWS Bedrock AgentCore: Zenity Labs researchers found that a single publicly accessible Bedrock AgentCore agent could, via an internal temporary-credential interface, take over every other agent in the same account and region; AWS has patched the issue and significantly tightened default agent permissions (see Deep Dive). (the-decoder)

DB-GPT's two critical RCE CVEs: the open-source AI agent platform DB-GPT 0.8.0 was found to have two unauthenticated remote-code-execution vulnerabilities (CVSS 9.1 and 9.8) — a directory traversal flaw and a broken sandbox mechanism — highlighting risk at the agent data-access layer. (forkast.news)

Ethereum researchers warn AI could break wallet security within months: Ethereum researchers Justin Drake and Vitalik Buterin warned that AI-assisted math progress could, in a worst case, break the signature schemes used by crypto wallets within months, recommending funds be moved to addresses that have never signed a transaction. (the-decoder)

Regulation & Governance

White House AI Responsibility Accord: announced a package of executive orders favoring an industry "self-regulation" approach, and established a "Super Intelligence Force" requiring an AI risk-and-opportunity report within 120 days, responding to concerns raised by recent agent-related security incidents. (crowell.com)

Anthropic's updated usage policy: now bans sustained abuse of Claude, and tightens restrictions on influence operations, weaponized drones and surveillance use cases. (the-decoder)

Regional Developments

China / Hong Kong

Manus's parent company Butterfly Effect raised over $500 million in a new round co-led by Boyu Capital and IDG Capital, with Tencent, HSG and ZhenFund participating — the first round since Beijing blocked Meta's $2 billion acquisition, at a reported $4 billion valuation. See this site's funding brief.

Alibaba Cloud unveiled its full edge-for-AI product lineup (ESA) at Apsara 2026 — 11 capabilities spanning three pillars: AI acceleration, AI security, and agent runtime. (alibabacloud)

Taiwan

Availability and pricing for three major personal AI agents — Meta Muse, OpenAI Dots and Grok Bot — diverge in Taiwan: Meta Muse hasn't officially launched there yet; OpenAI Dots is rolling out in batches, with Taiwan not excluded, but requires a ChatGPT Pro subscription (plans from US$100/month); Grok Bot is accessible via Cursor Pro (US$20/month). For individual users in Taiwan, Grok Bot is currently the cheapest way in. (gvm.com.tw)

Japan / Korea

South Korea's Shinhan Bank was breached via ARTEX + Claude Code, leaking 25,000+ customer records — see Security Incidents.

Anthropic's mass book-buying in Japan as training data has drawn backlash from local publishers, the latest flashpoint in Japan's debate over the legality of AI training data. (asia.nikkei.com)

Singapore has rolled out what it calls the world's first agentic-AI government governance framework and is leading ASEAN's AI governance guidelines; Japan's AI Promotion Act takes a principles-and-voluntary-cooperation approach; South Korea's legislation centers on promotion and trust; Meta's personal agent Muse is about to launch in Singapore, Japan, South Korea and Australia. (asiatimes.com)

Southeast Asia

Philippines-based Agentiq raised a $4 million seed round led by defy.vc, building an agent that lets fans invest in athletes through AI-driven financial tools. (af.net)

India / South Asia

Searched today; no qualifying AI-agent-related event found, so omitted.

Europe

Alibaba Group Chairman Joe Tsai said European enterprises building on open-source models have the ability to turn their own data into a competitive advantage, suggesting Europe still has a late-mover opportunity in the open-source AI wave. (alibabacloud)

Middle East

UAE startup Shory unveiled an AI agent at Ai Everything Abu Dhabi 2026 that helps consumers compare and purchase car insurance through conversation. (fintechnews.ae)

Africa

Cisco/Omdia's 2026 AI Readiness Index found only 39% of East African organizations are equipped to secure and govern AI agents, even as executives expect 55% of employees to be collaborating with AI agents within 24 months, making identity governance a board-level concern; the same report also notes growing commercial AI-agent automation momentum in Kenya and Nigeria. (cioafrica.co)

Latin America

Brazil's national agriculture and livestock federation (CNA/SENAR) deployed JoIA, a WhatsApp conversational AI assistant built on Gemini Enterprise, now reaching 40,000 active users with potential to support 5 million farmers, providing localized input pricing, weather forecasts and financial health assessments; Brazilian media giant Globo also deployed PlanejaAI, built on Gemini Enterprise, to speed up early-stage software planning, cutting validation time from 20 minutes to 6 seconds. (cloud.google.com)

Oceania

Australia's technology minister Andrew Charlton outlined a regulatory direction requiring AI companies to prove their safety systems actually work; unions and academics are calling for tech giants building data centers in Australia to fund local AI industry development through a levy. (abc.net.au)

Business Cases / Funding

Manus: see Regional Developments, China/Hong Kong.

Nous Research: raised a $90M Series B at a $1.5B valuation, led by Robot Ventures with participation from Nvidia and Samsung, planning to push its open-source Hermes Agent into the enterprise market. See this site's funding brief.

Rein Security: raised a $25M Series A co-led by Glilot Capital and Sienna Venture Capital, bringing total funding to $35M, building a runtime security platform for enterprise AI agents (see Deep Dive). See this site's funding brief.

Mecka AI: raised a $60M Series B led by Sequoia with participation from NVIDIA and Microsoft's M12 venture fund, collecting human-motion data to train humanoid robots — a continuation of data-labeling companies extending from LLMs into robotics. (techcrunch.com)

Socure acquires Fravity AI: identity-verification company Socure acquired agentic AI startup Fravity AI for $156M, folding it into its RiskOS platform (rebranded RiskOS_Agents) to automate document pulls, sanctions screening and case summarization. (msspalert.com)

Key Numbers

Item	Number	Source
Claude Haiku 5.5's OSWorld 2.1 improvement	15.7% → 72.4%	this site's model card
Manus parent company's new funding round	Over $500M	asia.nikkei.com
Rein Security Series A (total raised)	$25M (total $35M)	this site's funding brief
Scale AI visual-reasoning benchmark: best model vs. human	53.6% vs. 93.1%	superpowerdaily.com
Microsoft Dynamic Workflows token-usage reduction	56–93%	devblogs.microsoft.com

Today's Digests

Watch Tomorrow

After Zenity's AWS Bedrock AgentCore disclosure gets patched, whether other cloud agent platforms turn out to have similar "same-account cross-agent hijack" design flaws
Follow-up on the Shinhan Bank breach: whether South Korean regulators propose concrete controls on agentic pentesting tools like ARTEX
Whether Manus's parent's rumored $4B valuation gets confirmed in its next round, and whether it shapes fundraising strategy for other Chinese AI startups blocked from foreign acquisition

Today's Takeaway

I used to think an agent's commercial selling point and its attack surface were separate problems you could address on separate timelines — ship the product first, bolt on security later. Seeing Google's coworker-agent permission design and the AWS Bedrock AgentCore vulnerability surface almost simultaneously made me realize they're really the front and back of the same design decision: however much approval friction you remove for the agent, that's exactly how much no-approval room an attacker inherits once it's hijacked — you can't buy just one side of that trade.